rubygem-time -- ReDoS vulnerability

oooooooq reports: The Time parser mishandles invalid strings that have specific characters. It causes an increase in execution time for parsing strings to Time objects...

SUSE-SU-2023:1685-1 Security update for rubygem-rack

This update for rubygem-rack fixes the following issues: - CVE-2023-27539: Fixed denial of service in header parsing bsc1209503...

SUSE-SU-2023:1657-1 Security update for rubygem-loofah

This update for rubygem-loofah fixes the following issues: - CVE-2022-23514: Fixed inefficient regular expression leading to denial of service bsc1206415. - CVE-2022-23515: Fixed improper neutralization of data URIs leading to Cross Site Scripting bsc1206417. - CVE-2022-23516: Fixed uncontrolled...

RHEL 7 : Red Hat Gluster Storage web-admin-build (RHSA-2023:1486)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1486 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Django is a high-level Python...

rubygem-uri -- ReDoS vulnerability

Dominic Couture reports: A ReDoS issue was discovered in the URI component. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects...

Fedora 38 : ImageMagick / rubygem-rmagick (2023-f992309b7e)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-f992309b7e advisory. - Fix missing epoch in ImageMagick-heic requires 2181176 - Update ImageMagick to 7.1.1.4 2176749 - Add support to libheif and add html docs - Rebuild...

Fedora: Security Advisory for rubygem-rmagick (FEDORA-2023-f992309b7e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CBL Mariner 2.0 Security Update: rubygem-fluentd (CVE-2022-39379)

The version of rubygem-fluentd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-39379 advisory. - Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, Saa...

CVE-2023-27539

A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpected amount of time, possibly resulting in a denial of service. Mitigation Setting Regexp.timeout in Ruby 3.2 is a possible workaround...

CVE-2023-28120

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed. Mitigation Avoid calling bytesplice on a SafeBuffer htmlsafe string with untrusted user input...

SUSE SLES15: ruby2.5-rubygem-rack / ruby2.5-rubygem-rack-doc / etc (SUSE-SU-2023:0725-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0725-1 advisory. - CVE-2023-27530: Fixed denial of service in Multipart MIME parsing bsc1209095. Tenable has extracted the preceding description block...

SUSE-SU-2023:0725-1 Security update for rubygem-rack

This update for rubygem-rack fixes the following issues: - CVE-2023-27530: Fixed denial of service in Multipart MIME parsing bsc1209095...

OESA-2023-1154 rubygem-activesupport security update

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Security Fixes: A regular expression based DoS vulnerability in Active Support 6.1.7.1 and 7.0.4.1. A specially crafted...

CVE-2023-27530

A flaw was found in rubygem-rack. This issue occurs in the Multipart MIME parsing code in Rack, which limits the number of file parts but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than...

SUSE-SU-2023:0649-1 Security update for rubygem-rack

This update for rubygem-rack fixes the following issues: - CVE-2022-44570: Fixed a potential denial of service when parsing a RFC2183 multipart boundary bsc1207597. - CVE-2022-44571: Fixed a potential denial of service when parsing a Range header bsc1207599...

rubygem-rack 安全漏洞

rubygem-rack is an application in the rubygems open source. A security vulnerability exists in rubygem-rack, which stems from a denial of service vulnerability in the parsing...

SUSE-SU-2023:0612-1 Security update for rubygem-activesupport-4_2

This update for rubygem-activesupport-42 fixes the following issues: - CVE-2023-22796: Fixed a potential denial of service when passing a crafted input to the underscore method due to an inefficient regular expression bsc1207454...

SUSE-SU-2023:0587-1 Security update for rubygem-activerecord-4_2

This update for rubygem-activerecord-42 contains the following fixes: - CVE-2022-44566: Fixed a potential denial of service due to an inefficient comparison between integer and numeric values. bsc1207450 - fixed regression caused by fix for CVE-2022-44566. bsc1207450...

SUSE-SU-2023:0518-1 Security update for rubygem-activerecord-4_2

This update for rubygem-activerecord-42 fixes the following issues: - CVE-2022-44566: Fixed a potential denial of service due to an inefficient comparison between integer and numeric values bsc1207450...

SUSE-SU-2023:0492-1 Security update for rubygem-activerecord-5_1

This update for rubygem-activerecord-51 fixes the following issues: - CVE-2022-44566: Fixed possible denial of service vulnerability in ActiveRecord's PostgreSQL adapter bsc1207450...